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DETAILED ACTION 


1 . Claims 8-21 have been examined. Applicant has canceled claims 1-7 and added 
new claims 8-21 in the preliminary amendment filed on September 13, 2000. 


2. The following is a quotation of the first paragraph of 35 U.S.C. 112: 

The specification shall contain a written description of the invention, and of the manner and process of 
making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the 
art to which it pertains, or with which it is most nearly connected, to make and use the same and shall 
set forth the best mode contemplated by the inventor of carrying out his invention. 

3. Claims 10 and 17 are rejected under 35 U.S.C. 112, first paragraph, as failing to 
comply with the enablement requirement. The claim(s) contains subject matter which 
was not described in the specification in such a way as to enable one skilled in the art to 
which it pertains, or with which it is most nearly connected, to make and/or use the 
invention. The claims define the limitation wherein the table is a matrix and is indexed in 
columns by subscripts of the formulas appearing in the negative part of the Horn 
clauses and the lines are the Horn clauses exactly; however, the specification only 
discloses the table as a matrix that is indexed in columns by subscripts of the formulas 
appearing in the negative part of the Horn clauses and lines that are indexed by 
subscripts of the formulas appearing in the positive part of the Horn clauses (see 
Specification, page 6, lines 15-19). 


Claim Rejections - 35 USC §112 
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4. The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

5. Claims 8-13, 15, and 17-20 are rejected under 35 U.S.C. 112, second paragraph, 
as being indefinite for failing to particularly point out and distinctly claim the subject 
matter which applicant regards as the invention. 

6. Claim 8 recites the limitations "the records", "the implications resolvent of the 
subformulas", "the clause", "the specific language of the machine", "the positive part of 
the clause", "the link", and "the implicated subformula(s)". There is insufficient 
antecedent basis for these limitations in the claim. 

7. Regarding claim 8, the phrase "i.e." renders the claim indefinite because it is 
unclear whether the limitations following the phrase are part of the claimed invention. 
See MPEP§ 2173.05(d). 

8. Claim 9 recites the limitation "the formulation of the specification". There is 
insufficient antecedent basis for this limitation in the claim. 

9. Claim 10 recites the limitation "the lines". There is insufficient antecedent basis 
for this limitation in the claim. 
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10. Claim 1 1 recites the limitation "the implicit lines". There is insufficient antecedent 
basis for this limitation in the claim. 

1 1 . Claims 12 and 13 recite the limitation "the same formula". There is insufficient 
antecedent basis for this limitation In the claims. 

12. Claim 15 recites the limitations "the records", "the implications resolvent of the 
subformulas", "the clause", "the specific language of the machine", "the link", "the 
implicated subformula(s)", "the formulation of the specification", and "the information 
from the table". There is insufficient antecedent basis for these limitations In the claim. 

13. Regarding claim 15, the phrase "i.e." renders the claim Indefinite because it is 
unclear whether the limitations following the phrase are part of the claimed invention. 
See MPEP§ 2173.05(d). 

14. Claim 17 recites the limitation "the lines". There is insufficient antecedent basis 
for this limitation in the claim. 

15. Claim 18 recites the limitation "the implicit lines". There is insufficient antecedent 
basis for this limitation in the claim. 
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16. Claims 19 and 20 recite the limitation "the same formula". There is insufficient 
antecedent basis for this limitation in the claims. 

Claim Rejections - 35 USC § 103 

17. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

18. This application currently names joint inventors. In considering patentability of 
the claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of 
the various claims was commonly owned at the time any inventions covered therein 
were made absent any evidence to the contrary. Applicant is advised of the obligation 
under 37 CFR 1 .56 to point out the inventor and invention dates of each claim that was 
not commonly owned at the time a later invention was made in order for the examiner to 
consider the applicability of 35 U.S.C. 103(c) and potential 35 U.S.C. 102(e), (f) or (g) 
prior art under 35 U.S.C. 103(a). 

19. Claims 8-9, 14-16 and 21 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Smaha et al. U.S. Patent No. 5,557,742 (hereinafter Smaha) in view 
of Thuraisingham et al. U.S. Patent No. 5,694,590 (hereinafter Thuraisingham) and 
Schoning Logic for Computer Scientists (hereinafter Schoning). As per claims 15 and 
16, Smaha discloses a computer system comprising storage means and means for 


Application/Control Number: 09/661 ,448 Page 6 

Art Unit: 2132 

executing programs for implementing a high performance resolution method for deleting 
attacks against the system wherein the method: 

a. formulates audit conditions to be detected using non-limiting specification 
formulas expressing fraudulent entry or attack patterns or abnormal operations to 
be verified by examining the records of a log file of the computer system (see 
Smaha, Abstract, Figures 2b, 3, 4, and 5a). 
20. Smaha is silent on the matter of expanding the formulas into Horn clauses to 
detect attack conditions. However, the use of Horn clauses to articulate rules in a 
security framework is well implemented in the art. Thuraisingham discloses a method 
for detecting security violations in a secure database wherein data and constraints are 
modeled into Horn clauses to process the security risk of the data and to obtain a 
conflict resolution (see Thuraisingham, col. 14, lines 30-46). It would be obvious to one 
of ordinary skill in the art at the time the invention was made to apply the teaching of 
Thuraisingham to the invention disclosed by Smaha. Motivation for such an 
implementation enables the invention to utilize the consistency and completeness of 
Horn clause logic programs to determine the security threat as taught by 
Thuraisingham. In addition, although Thuraisingham does not cover in detail how rules 
are specified into Horn clauses, means to do so are found in Schoning. Schoning 
teaches a method for taking literals, representing an atomic formula being either a 
positive or negative (see Schoning, page 18, definition of literal), defining a set of 
formulas from a set of literals having CNF form (see Schoning, pages 19-23), then 
converting the formulas to Horn formulas, resolving and testing for satisfiability (see 
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Schoning, pages 23-24, especially page 23, last paragraph and page 24, 'efficient test 
for satisfiability'; pages 29-35, section 1.5, Resolution, especially page 30-31, definition 
of resolvent and page 32, Exercise 29). It would be obvious to one of ordinary skill in 
the art at the time the invention was made to apply the teaching of Schoning to the 
invention covered by Smaha. Motivation for such an implementation utilizes standard 
means for assigning and translating data/constraints to Horn clauses. Hence, this 
method covers the following steps: 

b. expands the formulas into subformulas (see Schoning, page 19, Theorem; 
page 23, formula F, last equation); 

c. scans by an interpreter, and generates, for each expanded formula in 
each record, Horn clauses to resolve in order to detect whether or not the 
formula is valid in the record, the Horn clauses expressing the implications 
resolvent of the subformulas for each record scanned, in positive clauses, 
wherein at most one positive literal Is counted, and in non-positive clauses, 
wherein at least one negative literal is counted, which negative literals form the 
negative part of the clause (see Schoning, page 23, definition of Horn formula; 
pages 29-35, section 1.5, Resolution, especially pages 30-31, definition of 
resolvent); 

d. stores positive Horn clauses in a stack of worked subformulas, and 
storing, in a table comprising a representation, implicating subformula(s) 
constituting the positive part of the clause, and stores in a counter the number of 
formulas or subformulas present in the negative part of the clause for each 
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implicated subformula (see Schoning page 35, 'algorithm to decide satisfiability'); 
and 

e. resolves the table based on each positive clause encountered, so as to 
generate either an output file or an action of the computer system (see Smaha, 
Figure 5a, Reference Nos. 32 and 42 as modified by Schoning, page 35, 
'algorithm to decide satisfiability'; pages 117-131, section 3.2, Horn Clause 
Programs). 

21 . Finally, the above steps is implemented by means of: an adaptor for translating 
information from a log file into a language comprehensible to an interpreter (see Smaha, 
Figure 5a, Reference No. 12 as modified by Schoning, page 3, 'atomic sentences'); an 
interpreter for receiving a formulation of a specification in a temporal logic in a 
specification formula in order to expand the formula and fill in the table and the stack of 
worked subformulas stored in the memory of the computer system and resulting from 
the scanning of the computer system's log file (see Smaha, Figure 5a, Reference Nos. 
144 and 142; col. 9, lines 56-67 as modified by Schoning, page 4-5, definition for syntax 
and semantics of prepositional logic; page 9, definition of suitable assignment, model, 
satisfiable, valid; pages 14-23, section 1.2 Equivalence and Normal Forms); and a 
clause processing algorithm for resolving the Horn clauses to generate an output file or 
an action (see Smaha, Figure 5a, Reference Nos. 32 and 42 as modified by Schoning, 
page 35, 'algorithm to decide satisfiability'; pages 117-131, section 3.2, Horn Clause 
Programs), The aforementioned cover claims 15 and 16. 
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22. As per claim 21 , Smaha covers a computer system as outlined above in the 
claim 15 rejection under 35 U.S.C. 103(a). Although Smaha does not expressly 
disclose scanning the log file only once from the beginning to the end, it is notoriously 
well-known in the art to implement means to reduce the number of runs for a given task 
to a minimum. The examiner takes Official Notice of this teaching. It would be obvious 
to one of ordinary skill in the art at the time the invention was made to scan the log file 
completely only once. Motivation for such an implementation would eliminate redundant 
work. 

23. As per claims 8-9 and 14, they are method claims corresponding to claims 15-16 
and 21 and they do not teach or define above the information claimed in claims 15-16 
and 21 . Therefore, claims 8-9 and 14 are rejected as being unpatentable over Smaha 
in view of Thuraisingham and Schoning for the same reasons set forth in the rejections 
of claims 15-16 and 21. 

24. Claims 10-13 and 17-20 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Smaha in view of Thuraisingham and Schoning, and further in view 
of Cormen et al. Introduction to Algorithms (hereinafter Gormen). As per claims 17 and 
18, Smaha covers a computer system as outlined above in the claim 15 rejection under 
35 U.S.C. 103(a). Smaha does not expressly disclose representing the table in the form 
of a matrix or a sparse matrix having columns represented by means of chained lists 
and implicit lines. However, as taught by Cormen, these means are the two standard 
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ways to represent relationships between data of a set with at least one other data of the 
set (see Gormen, page 465, 3^^ paragraph, first sentence; page 466, Figure 23.1). It 
would be obvious to one of ordinary skill in the art at the time the invention was made to 
apply the teaching of Gormen to the invention covered by Smaha, since sparse matrix 
and matrix formations are the two standard means of representing relations between 
data of a set. 

25. As per claims 19 and 20, Smaha covers a computer system as outlined above in 
the claim 15 and 16 rejections under 35 U.S.G. 103(a). Smaha does not expressly 
disclose the use of a hash table in the step of expanding formulas into subformulas. 
However, In a different section, Gormen teaches the use of hash tables to efficiently 
devise a one-to-one mapping structure as an alternative to a direct addressing scheme 
(see Gormen, pages 221-222, section 12.2, 'Hash Tables'). Formulas stored in a hash 
table rather then a direct addressing scheme to be expanded into subformulas would be 
more efficient since the universe of formulas would probably be much greater then the 
actual number of formulas to be expanded. It would be obvious to one of ordinary skill 
in the art at the time the invention was made to apply the teaching of Gormen to the 
invention covered by Smaha. Motivation for such an implementation enables the 
formulas to be uniquely addressed but stored in manner that is better optimized for a 
subset of formulas drawn from a large set of possible formulas as taught by Gormen. 
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26. As per claims 10-13, they are method claims corresponding to claims 17-20 and 
they do not teach or define above the information claimed in claims 17-20. Therefore, 
claims 10-13 are rejected as being unpatentable over Smaha in view of Thuraisingham, 
Schoning, and Gormen for the same reasons set forth in the rejections of claims 17-20. 

Conclusion 

The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

Thuraisingham et al. U.S. Patent No. 5,355,474. 
Cohen U.S. Patent No. 5,481,650. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Jung W Kim whose telephone number is (703) 305- 
8289. The examiner can normally be reached on M-F 9:00-6:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gilberto Barron can be reached on (703) 305-1830. The fax phone number 
for the organization where this application or proceeding is assigned is 703-872-9306. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-21 7-91 97 (toll-free), f ) 



Jung W Kim 
Examiner 
Art Unit 21 32 


Jk 

May 24, 2004 



GILBERTO BARRON 
SUPERVISORY PATENT EXAMINER 
TECHNOLOGY CENTER 2100 


